<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="theme-color" content="#222">
<meta name="generator" content="Hexo 5.2.0">
  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png">
  <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32-next.png">
  <link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16-next.png">
  <link rel="mask-icon" href="/images/logo.svg" color="#222">

<link rel="stylesheet" href="/css/main.css">


<link rel="stylesheet" href="/lib/font-awesome/css/all.min.css">
  <link rel="stylesheet" href="/lib/pace/pace-theme-minimal.min.css">
  <script src="/lib/pace/pace.min.js"></script>

<script id="hexo-configurations">
    var NexT = window.NexT || {};
    var CONFIG = {"hostname":"sekla.cn","root":"/","scheme":"Muse","version":"7.8.0","exturl":false,"sidebar":{"position":"right","display":"post","padding":18,"offset":12,"onmobile":false},"copycode":{"enable":false,"show_result":false,"style":null},"back2top":{"enable":true,"sidebar":false,"scrollpercent":false},"bookmark":{"enable":false,"color":"#222","save":"auto"},"fancybox":false,"mediumzoom":false,"lazyload":false,"pangu":false,"comments":{"style":"tabs","active":"valine","storage":true,"lazyload":false,"nav":null},"algolia":{"hits":{"per_page":10},"labels":{"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}},"localsearch":{"enable":false,"trigger":"auto","top_n_per_article":1,"unescape":false,"preload":false},"motion":{"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},"path":"search.xml"};
  </script>

  <meta name="description" content="Seed实验官方网站：https:&#x2F;&#x2F;seedsecuritylabs.org&#x2F; 实验环境：腾讯云Ubuntu-20.04 云服务器环境配置：https:&#x2F;&#x2F;github.com&#x2F;seed-labs&#x2F;seed-labs&#x2F;blob&#x2F;master&#x2F;manuals&#x2F;cloud&#x2F;seedvm-cloud.md">
<meta property="og:type" content="article">
<meta property="og:title" content="Seed安全实验系列-(1)-Set Uid实验">
<meta property="og:url" content="http://sekla.cn/2021/10/19/ss-lab1-setuid/index.html">
<meta property="og:site_name" content="Sekla&#39;s Blog">
<meta property="og:description" content="Seed实验官方网站：https:&#x2F;&#x2F;seedsecuritylabs.org&#x2F; 实验环境：腾讯云Ubuntu-20.04 云服务器环境配置：https:&#x2F;&#x2F;github.com&#x2F;seed-labs&#x2F;seed-labs&#x2F;blob&#x2F;master&#x2F;manuals&#x2F;cloud&#x2F;seedvm-cloud.md">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://i.loli.net/2021/10/19/JDcl6REzNTix8uM.png">
<meta property="og:image" content="https://i.loli.net/2021/10/19/XFA3MdwJHpnfVTZ.png">
<meta property="og:image" content="https://i.loli.net/2021/10/19/fW4zvT8GltsYykR.png">
<meta property="og:image" content="https://i.loli.net/2021/10/19/HozlbA8spDYwkd4.png">
<meta property="og:image" content="https://i.loli.net/2021/10/19/gKbfwLMP1he4VDS.png">
<meta property="og:image" content="https://i.loli.net/2021/10/20/NgDnYcJCpBuP1HZ.png">
<meta property="og:image" content="https://i.loli.net/2021/10/19/S2qwtzD691gFMAp.png">
<meta property="og:image" content="https://i.loli.net/2021/10/19/ZVNWrdC9v2pgQyP.png">
<meta property="og:image" content="https://i.loli.net/2021/10/19/ZKEaOhPz85swNeH.png">
<meta property="og:image" content="https://i.loli.net/2021/10/19/BvU7GKrJfwTmYzs.png">
<meta property="og:image" content="https://i.loli.net/2021/10/19/SA9bLlYo6drEgQj.png">
<meta property="og:image" content="https://i.loli.net/2021/10/19/NWPcGDTjAKweUk5.png">
<meta property="og:image" content="https://i.loli.net/2021/10/19/vr2Cjg8N6Fp3Rzq.png">
<meta property="og:image" content="https://i.loli.net/2021/10/19/rZiBgNmAD4Jp6cK.png">
<meta property="og:image" content="https://i.loli.net/2021/10/19/SYU3VJqBcMDjhF1.png">
<meta property="article:published_time" content="2021-10-19T02:00:00.000Z">
<meta property="article:modified_time" content="2021-10-26T08:11:17.446Z">
<meta property="article:author" content="Sekla">
<meta property="article:tag" content="Linux">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://i.loli.net/2021/10/19/JDcl6REzNTix8uM.png">

<link rel="canonical" href="http://sekla.cn/2021/10/19/ss-lab1-setuid/">


<script id="page-configurations">
  // https://hexo.io/docs/variables.html
  CONFIG.page = {
    sidebar: "",
    isHome : false,
    isPost : true,
    lang   : 'zh-CN'
  };
</script>

  <title>Seed安全实验系列-(1)-Set Uid实验 | Sekla's Blog</title>
  






  <noscript>
  <style>
  .use-motion .brand,
  .use-motion .menu-item,
  .sidebar-inner,
  .use-motion .post-block,
  .use-motion .pagination,
  .use-motion .comments,
  .use-motion .post-header,
  .use-motion .post-body,
  .use-motion .collection-header { opacity: initial; }

  .use-motion .site-title,
  .use-motion .site-subtitle {
    opacity: initial;
    top: initial;
  }

  .use-motion .logo-line-before i { left: initial; }
  .use-motion .logo-line-after i { right: initial; }
  </style>
</noscript>

  <script type="text/javascript" src="/js/my_js/clicklove.js"></script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --></head>

<body itemscope itemtype="http://schema.org/WebPage">
  <div class="container use-motion">
    <div class="headband"></div>

    <header class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-container">
  <div class="site-nav-toggle">
    <div class="toggle" aria-label="切换导航栏">
      <span class="toggle-line toggle-line-first"></span>
      <span class="toggle-line toggle-line-middle"></span>
      <span class="toggle-line toggle-line-last"></span>
    </div>
  </div>

  <div class="site-meta">

    <a href="/" class="brand" rel="start">
      <span class="logo-line-before"><i></i></span>
      <h1 class="site-title">Sekla's Blog</h1>
      <span class="logo-line-after"><i></i></span>
    </a>
      <p class="site-subtitle" itemprop="description">Keep Learning Keep Doing</p>
  </div>

  <div class="site-nav-right">
    <div class="toggle popup-trigger">
    </div>
  </div>
</div>




<nav class="site-nav">
  <ul id="menu" class="main-menu menu">
        <li class="menu-item menu-item-home">

    <a href="/" rel="section"><i class="fa fa-home fa-fw"></i>首页</a>

  </li>
        <li class="menu-item menu-item-about">

    <a href="/about/" rel="section"><i class="fa fa-user fa-fw"></i>关于</a>

  </li>
        <li class="menu-item menu-item-tags">

    <a href="/tags/" rel="section"><i class="fa fa-tags fa-fw"></i>标签<span class="badge">14</span></a>

  </li>
        <li class="menu-item menu-item-categories">

    <a href="/categories/" rel="section"><i class="fa fa-th fa-fw"></i>分类<span class="badge">23</span></a>

  </li>
        <li class="menu-item menu-item-archives">

    <a href="/archives/" rel="section"><i class="fa fa-archive fa-fw"></i>归档<span class="badge">100</span></a>

  </li>
  </ul>
</nav>




</div>
    </header>

    
  <div class="back-to-top">
    <i class="fa fa-arrow-up"></i>
    <span>0%</span>
  </div>
  <div class="reading-progress-bar"></div>


    <main class="main">
      <div class="main-inner">
        <div class="content-wrap">
          

          <div class="content post posts-expand">
            

    
  
  
  <article itemscope itemtype="http://schema.org/Article" class="post-block" lang="zh-CN">
    <link itemprop="mainEntityOfPage" href="http://sekla.cn/2021/10/19/ss-lab1-setuid/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="image" content="/images/avatar.jpg">
      <meta itemprop="name" content="Sekla">
      <meta itemprop="description" content="Sekla">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Sekla's Blog">
    </span>
      <header class="post-header">
        <h1 class="post-title" itemprop="name headline">
          Seed安全实验系列-(1)-Set Uid实验
        </h1>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="far fa-calendar"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              <time title="创建时间：2021-10-19 10:00:00" itemprop="dateCreated datePublished" datetime="2021-10-19T10:00:00+08:00">2021-10-19</time>
            </span>
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="far fa-calendar-check"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2021-10-26 16:11:17" itemprop="dateModified" datetime="2021-10-26T16:11:17+08:00">2021-10-26</time>
              </span>
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="far fa-folder"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/%E8%BD%AF%E4%BB%B6%E5%AE%89%E5%85%A8/" itemprop="url" rel="index"><span itemprop="name">软件安全</span></a>
                </span>
                  ，
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/%E8%BD%AF%E4%BB%B6%E5%AE%89%E5%85%A8/Seed%E5%AE%89%E5%85%A8%E5%AE%9E%E9%AA%8C%E7%B3%BB%E5%88%97/" itemprop="url" rel="index"><span itemprop="name">Seed安全实验系列</span></a>
                </span>
            </span>

          
            <span class="post-meta-item" title="阅读次数" id="busuanzi_container_page_pv" style="display: none;">
              <span class="post-meta-item-icon">
                <i class="fa fa-eye"></i>
              </span>
              <span class="post-meta-item-text">阅读次数：</span>
              <span id="busuanzi_value_page_pv"></span>
            </span><br>
            <span class="post-meta-item" title="本文字数">
              <span class="post-meta-item-icon">
                <i class="far fa-file-word"></i>
              </span>
                <span class="post-meta-item-text">本文字数：</span>
              <span>3.2k</span>
            </span>
            <span class="post-meta-item" title="阅读时长">
              <span class="post-meta-item-icon">
                <i class="far fa-clock"></i>
              </span>
                <span class="post-meta-item-text">阅读时长 &asymp;</span>
              <span>3 分钟</span>
            </span>

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
        <h1 id="Seed实验"><a href="#Seed实验" class="headerlink" title="Seed实验"></a>Seed实验</h1><p>官方网站：<a target="_blank" rel="noopener" href="https://seedsecuritylabs.org/">https://seedsecuritylabs.org/</a></p>
<p>实验环境：腾讯云Ubuntu-20.04</p>
<p>云服务器环境配置：<a target="_blank" rel="noopener" href="https://github.com/seed-labs/seed-labs/blob/master/manuals/cloud/seedvm-cloud.md">https://github.com/seed-labs/seed-labs/blob/master/manuals/cloud/seedvm-cloud.md</a></p>
<a id="more"></a>

<h2 id="Set-Uid背景"><a href="#Set-Uid背景" class="headerlink" title="Set-Uid背景"></a>Set-Uid背景</h2><p>​    linux的密码是存储在/etc/shadow这个影子文件中的，这个文件的权限设置成只有root用户 才可以访问，但是修改密码必须要修改该文件，那普通用户如何实现修改自己的密码呢？多数系统 用特权程序来解决这个问题，这个特权程序叫passwd。特权程序的实现方式有两种，守护进程和Set-UID程序。守护进程用root身份运行，普通程序向他发请求解决。Set-UID用一个比特位告诉操作系统区别对待。Set-UID的好处是不用另起root程序，普通用户就可以完成 修改密码操作。而赋予Set-UID权限后，普通用户只能执行Set-UID中定义好的操作。</p>
<p>​    /bin/sh变成Set-UID不是安全做法，因该程序可以执行用户指定的任意命令<br>vi程序变成Set-UID也不是安全做法，因允许用户在编辑器内执行任意外部命令。</p>
<p><strong>真实用户id（uid）: 运行进程的用户，运行命令/bin/id</strong>。<br><strong>有效用户id（euid）: 访问控制中使用的id，就是程序的所有者。</strong><br><strong>保留用户id。</strong></p>
<p>​    只有当文件所有者为root用户时，才能通过Set-UID改变其有效用户id。而4755中的4设置了 Set-UID比特使有效用户id（euid）为0，成为特权程序。<strong>这种情况下，即使该进程由普通用户执行，也拥有root用户权限</strong>。即使所有者是root，只要有效用户id不为0，还是一个非特权程序。同样，如果只是设置Set-UID，文件所有者不是root，也是非特权程序。</p>
<h2 id="实验内容"><a href="#实验内容" class="headerlink" title="实验内容"></a>实验内容</h2><p>注意：chown命令自动清空setUid位，所以需要先chown再chmod。</p>
<h3 id="1-操纵环境变量"><a href="#1-操纵环境变量" class="headerlink" title="1.操纵环境变量"></a>1.操纵环境变量</h3><p>在shell中使用printenv或者env指令来打印环境变量，export或者unset来导出或者解除环境变量。export或者unset为shell内置命令。</p>
<p><img src="https://i.loli.net/2021/10/19/JDcl6REzNTix8uM.png" alt="lab1-1"></p>
<h3 id="2-父进程向子进程传递环境变量"><a href="#2-父进程向子进程传递环境变量" class="headerlink" title="2.父进程向子进程传递环境变量"></a>2.父进程向子进程传递环境变量</h3><p>编译并运行试验所给程序，然后根据要求修改打印地方，重定向输出之后来看打印的环境变量有什么不同。</p>
<p><img src="https://i.loli.net/2021/10/19/XFA3MdwJHpnfVTZ.png"></p>
<p>这说明用fork创建的子进程会继承父进程的环境变量，通过execve调用的话，环境变量会丢失，必须要作为参数显式地传递。</p>
<p>环境变量内存结构：</p>
<p><img src="https://i.loli.net/2021/10/19/fW4zvT8GltsYykR.png"></p>
<h3 id="3-环境变量和execve系统调用"><a href="#3-环境变量和execve系统调用" class="headerlink" title="3.环境变量和execve系统调用"></a>3.环境变量和execve系统调用</h3><p>​    前面提到execve系统调用如果在一个进程中使用，环境变量会丢失，必须要作为参数显式地传递，execve不会创建新的进程，原有进程的内存映像被完全替换成新程序，又因为exec不创建新进程，所以PID没有变化，exec只是用磁盘上的新程序替换了当前进程的正文，数据，堆，栈段。所以环境变量也被替换了。</p>
<p>根据实验指导提供的程序编译并运行：</p>
<p><img src="https://i.loli.net/2021/10/19/HozlbA8spDYwkd4.png" alt="lab1-3"></p>
<p>第一次执行execve调用没有传递环境变量，第二次修改传递了本次进程的环境变量，两次打印出的环境变量不同。</p>
<h3 id="4-环境变量和system系统调用"><a href="#4-环境变量和system系统调用" class="headerlink" title="4.环境变量和system系统调用"></a>4.环境变量和system系统调用</h3><p>system()调用实际上是调用shell执行命令，system()的实现是用execl()系统调用来运行shell然后execve()传递环境变量数组，所以用system系统调用，当前进程的环境变量会传递给新程序。</p>
<p><img src="https://i.loli.net/2021/10/19/gKbfwLMP1he4VDS.png"></p>
<h3 id="5-环境变量和Set-Uid程序"><a href="#5-环境变量和Set-Uid程序" class="headerlink" title="5.环境变量和Set-Uid程序"></a>5.环境变量和Set-Uid程序</h3><p>用户可以通过环境变量来影响setUid程序的行为，这次来看看set-uid程序进程是否继承了用户的环境变量。</p>
<p>编写编译运行试验指导程序，然后把程序变成setUid程序：</p>
<p><img src="https://i.loli.net/2021/10/20/NgDnYcJCpBuP1HZ.png" alt="lab1-5.1"></p>
<p>然后在非root账户下用export设置PATH，LD_LIBRARY_PATH，ANY_NAME环境变量。然后再运行setUid程序在第二步的shell中，检查是否所有的在父进程shell设置的环境变量都传递到了setUid程序子进程。</p>
<h3 id="6-PATH环境变量和Set-Uid程序"><a href="#6-PATH环境变量和Set-Uid程序" class="headerlink" title="6.PATH环境变量和Set-Uid程序"></a>6.PATH环境变量和Set-Uid程序</h3><p>实验提供的程序编译并设置为SET-UID程序，程序执行system(“ls”)调用，要让程序执行自己的命令。</p>
<p>Ubuntu 16.04以上版本，/bin/sh实际上是一个指向/bin/dash的链接文件，dash实现了 一个保护机制，当它发现自己在一个Set-UID的进程中运行时，会立刻把有效用户id变成实际 用户id，主动放弃特权。故利用/bin/sh发起的攻击不会成功。</p>
<p><img src="https://i.loli.net/2021/10/19/S2qwtzD691gFMAp.png" alt="lab6-2"></p>
<p>用<code>sudo ln -sf /bin/zsh /bin/sh</code>改成zsh后，使用命令，这个ls不提供具体路径就是一个不安全的方式，可以在环境变量中设置一个恶意的ls程序攻击。</p>
<h3 id="7-LD-PRELOAD环境变量和Set-Uid程序"><a href="#7-LD-PRELOAD环境变量和Set-Uid程序" class="headerlink" title="7.LD_PRELOAD环境变量和Set-Uid程序"></a>7.LD_PRELOAD环境变量和Set-Uid程序</h3><p><strong>动态链接过程</strong>：</p>
<p>可执行文件运行前首先被载入内存（装载），装载器把控制权交给动态链接器，动态链接器从共享库中 找到具体函数实现，并把可执行文件中对该函数的调用链接到实现代码。链接完成把控制权交给main函数。使用动态链接时，程序一部分代码在编译过程中是不确定的，在运行时才被确定。此时用户有完全控制权， 如果用特权程序链接恶意代码，就有安全风险。</p>
<p>动态链接相关的环境变量：<br><strong>LD_PRELOAD</strong>环境变量包含共享库的一个列表，动态链接器首先在这个列表中搜索库函数的实现（即预先加载),</p>
<p><strong>LD_LIBRARY_PATH</strong>预先加载中找不到就在这个目录中找。</p>
<p>创建自己的动态链接库：</p>
<p><img src="https://i.loli.net/2021/10/19/ZVNWrdC9v2pgQyP.png" alt="lab1-7"></p>
<p><img src="https://i.loli.net/2021/10/19/ZKEaOhPz85swNeH.png" alt="lab1-7-2"></p>
<p>设置环境变量LD_PRELOAD路径。</p>
<p><img src="https://i.loli.net/2021/10/19/BvU7GKrJfwTmYzs.png" alt="lab1-7-4"></p>
<p><img src="https://i.loli.net/2021/10/19/SA9bLlYo6drEgQj.png" alt="lab1-7-5"></p>
<p>如果正常调用则调用系统函数则实现睡眠1秒，自己的共享库与系统调用函数sleep相同名称，</p>
<p><img src="https://i.loli.net/2021/10/19/NWPcGDTjAKweUk5.png" alt="lab1-6-final"></p>
<p>设置为Set-Uid程序之后：</p>
<p><img src="https://i.loli.net/2021/10/19/vr2Cjg8N6Fp3Rzq.png" alt="lab1-7-3"></p>
<p>所以<strong>系统对动态链接环境变量有保护</strong>，动态链接器（ld.so或ld-linux.so）实现了防御策略，当进程真实用户id和有效用户id不一样（或者组），进程将忽略LD_PRELOAD等环境变量。</p>
<h3 id="8-使用system和execve调用外部程序"><a href="#8-使用system和execve调用外部程序" class="headerlink" title="8.使用system和execve调用外部程序"></a>8.使用system和execve调用外部程序</h3><p>尽管system()和execve()都可以用于运行新程序，但如果在特权程序(如Set-UID程序)中使用system()，则非常危险。 我们已经看到PATH环境变量如何影响system()的行为，因为该变量影响shell的工作方式。 Execve()没有这个问题，因为它不调用shell。 </p>
<p>实验提供了一个cat命令程序，让他成为Set-Uid程序，通过这个程序来实现自己的命令。</p>
<p>肯定的system命令可以通过类似6的方法来进行执行，execve则没有效果。</p>
<p><img src="https://i.loli.net/2021/10/19/rZiBgNmAD4Jp6cK.png"></p>
<p>如图。记得别忘记设置<code>sudo ln -sf /bin/dash /bin/sh</code>回来。</p>
<h3 id="9-限权泄露"><a href="#9-限权泄露" class="headerlink" title="9.限权泄露"></a>9.限权泄露</h3><p>​    为了遵循最小特权原则，Set-UID程序经常永久地放弃它们的root权限。 有时候程序需要把控制权交给用户; 在这种情况下，必须撤销root权限。 可以使用setuid()系统调用来撤销权限。 根据手册，“setuid()设置调用进程的有效用户ID。 如果调用者的有效UID是root，那么也会设置真实的UID和保存的set-user-id为root。如果有效UID为0的set -UID程序调用setuid(n)，该进程将成为一个普通进程，其所有UID都被设置为n。当撤销特权时，一个常见的错误是能力泄漏。 尽管进程的有效用户ID变得没有特权，但进程仍然享有特权，因为它拥有特权功能。 编译以下程序，将其所有者改为root，并使其成为一个Set-UID程序。 运行  程序作为一个普通用户。 你能利用这个程序中的能力泄漏漏洞吗? 目标是像普通用户一样写入/etc/zzz文件。  </p>
<p>首先程序打开了一个只有root用户可以修改的文件setuid(getuid());这行作用是将有效用户id（root）变成真实用户id，降低权限，execve打开了一个shell程序。</p>
<p><img src="https://i.loli.net/2021/10/19/SYU3VJqBcMDjhF1.png"></p>
<p>用泄露的权限使普通用户可以修改受保护的文件。运行set-uid程序获得了文件描述符之后可以修改文件，权限的泄露是因为没有关闭文件句柄导致。</p>

    </div>
    
    
    

      <footer class="post-footer">
          
          <div class="post-tags">
              <a href="/tags/Linux/" rel="tag"><i class="fa fa-tag"></i> Linux</a>
          </div>

        


        
    <div class="post-nav">
      <div class="post-nav-item">
    <a href="/2021/10/18/os-lab2-pre/" rel="prev" title="MIT6.S081-Lab2预备(1)-xv6架构和系统调用">
      <i class="fa fa-chevron-left"></i> MIT6.S081-Lab2预备(1)-xv6架构和系统调用
    </a></div>
      <div class="post-nav-item">
    <a href="/2021/10/19/exgcd-eulerfunc-ny/" rel="next" title="数论(3)-欧几里得和费马小定理求逆元">
      数论(3)-欧几里得和费马小定理求逆元 <i class="fa fa-chevron-right"></i>
    </a></div>
    </div>
      </footer>
    
  </article>
  
  
  



          </div>
          

<script>
  window.addEventListener('tabs:register', () => {
    let { activeClass } = CONFIG.comments;
    if (CONFIG.comments.storage) {
      activeClass = localStorage.getItem('comments_active') || activeClass;
    }
    if (activeClass) {
      let activeTab = document.querySelector(`a[href="#comment-${activeClass}"]`);
      if (activeTab) {
        activeTab.click();
      }
    }
  });
  if (CONFIG.comments.storage) {
    window.addEventListener('tabs:click', event => {
      if (!event.target.matches('.tabs-comment .tab-content .tab-pane')) return;
      let commentClass = event.target.classList[1];
      localStorage.setItem('comments_active', commentClass);
    });
  }
</script>

        </div>
          
  
  <div class="toggle sidebar-toggle">
    <span class="toggle-line toggle-line-first"></span>
    <span class="toggle-line toggle-line-middle"></span>
    <span class="toggle-line toggle-line-last"></span>
  </div>

  <aside class="sidebar">
    <div class="sidebar-inner">

      <ul class="sidebar-nav motion-element">
        <li class="sidebar-nav-toc">
          文章目录
        </li>
        <li class="sidebar-nav-overview">
          站点概览
        </li>
      </ul>

      <!--noindex-->
      <div class="post-toc-wrap sidebar-panel">
          <div class="post-toc motion-element"><ol class="nav"><li class="nav-item nav-level-1"><a class="nav-link" href="#Seed%E5%AE%9E%E9%AA%8C"><span class="nav-number">1.</span> <span class="nav-text">Seed实验</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#Set-Uid%E8%83%8C%E6%99%AF"><span class="nav-number">1.1.</span> <span class="nav-text">Set-Uid背景</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E5%AE%9E%E9%AA%8C%E5%86%85%E5%AE%B9"><span class="nav-number">1.2.</span> <span class="nav-text">实验内容</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#1-%E6%93%8D%E7%BA%B5%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F"><span class="nav-number">1.2.1.</span> <span class="nav-text">1.操纵环境变量</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#2-%E7%88%B6%E8%BF%9B%E7%A8%8B%E5%90%91%E5%AD%90%E8%BF%9B%E7%A8%8B%E4%BC%A0%E9%80%92%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F"><span class="nav-number">1.2.2.</span> <span class="nav-text">2.父进程向子进程传递环境变量</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#3-%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E5%92%8Cexecve%E7%B3%BB%E7%BB%9F%E8%B0%83%E7%94%A8"><span class="nav-number">1.2.3.</span> <span class="nav-text">3.环境变量和execve系统调用</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#4-%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E5%92%8Csystem%E7%B3%BB%E7%BB%9F%E8%B0%83%E7%94%A8"><span class="nav-number">1.2.4.</span> <span class="nav-text">4.环境变量和system系统调用</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#5-%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E5%92%8CSet-Uid%E7%A8%8B%E5%BA%8F"><span class="nav-number">1.2.5.</span> <span class="nav-text">5.环境变量和Set-Uid程序</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#6-PATH%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E5%92%8CSet-Uid%E7%A8%8B%E5%BA%8F"><span class="nav-number">1.2.6.</span> <span class="nav-text">6.PATH环境变量和Set-Uid程序</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#7-LD-PRELOAD%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E5%92%8CSet-Uid%E7%A8%8B%E5%BA%8F"><span class="nav-number">1.2.7.</span> <span class="nav-text">7.LD_PRELOAD环境变量和Set-Uid程序</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#8-%E4%BD%BF%E7%94%A8system%E5%92%8Cexecve%E8%B0%83%E7%94%A8%E5%A4%96%E9%83%A8%E7%A8%8B%E5%BA%8F"><span class="nav-number">1.2.8.</span> <span class="nav-text">8.使用system和execve调用外部程序</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#9-%E9%99%90%E6%9D%83%E6%B3%84%E9%9C%B2"><span class="nav-number">1.2.9.</span> <span class="nav-text">9.限权泄露</span></a></li></ol></li></ol></li></ol></div>
      </div>
      <!--/noindex-->

      <div class="site-overview-wrap sidebar-panel">
        <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <img class="site-author-image" itemprop="image" alt="Sekla"
      src="/images/avatar.jpg">
  <p class="site-author-name" itemprop="name">Sekla</p>
  <div class="site-description" itemprop="description">Sekla</div>
</div>
<div class="site-state-wrap motion-element">
  <nav class="site-state">
      <div class="site-state-item site-state-posts">
          <a href="/archives/">
        
          <span class="site-state-item-count">100</span>
          <span class="site-state-item-name">日志</span>
        </a>
      </div>
      <div class="site-state-item site-state-categories">
            <a href="/categories/">
          
        <span class="site-state-item-count">23</span>
        <span class="site-state-item-name">分类</span></a>
      </div>
      <div class="site-state-item site-state-tags">
            <a href="/tags/">
          
        <span class="site-state-item-count">14</span>
        <span class="site-state-item-name">标签</span></a>
      </div>
  </nav>
</div>
  <div class="links-of-author motion-element">
      <span class="links-of-author-item">
        <a href="https://github.com/ShenTiao" title="GitHub → https:&#x2F;&#x2F;github.com&#x2F;ShenTiao" rel="noopener" target="_blank"><i class="fab fa-github fa-fw"></i>GitHub</a>
      </span>
      <span class="links-of-author-item">
        <a href="mailto:584892986@qq.com" title="E-Mail → mailto:584892986@qq.com" rel="noopener" target="_blank"><i class="fa fa-envelope fa-fw"></i>E-Mail</a>
      </span>
  </div>



      </div>

      <iframe frameborder="no" border="0" marginwidth="0" marginheight="0" width=330 height=86 src="//music.163.com/outchain/player?type=2&id=1416875904&auto=0&height=66"></iframe>
      
    </div>
  </aside>
  <div id="sidebar-dimmer"></div>


      </div>
    </main>

    <footer class="footer">
      <div class="footer-inner">
        

        

<div class="copyright">
  
  &copy; 
  <span itemprop="copyrightYear">2022</span>
  <span class="with-love">
    <i class="fa fa-heart"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">Sekla</span>
    <span class="post-meta-divider">|</span>
    <span class="post-meta-item-icon">
      <i class="fa fa-chart-area"></i>
    </span>
    <span title="站点总字数">288k</span>
    <span class="post-meta-divider">|</span>
    <span class="post-meta-item-icon">
      <i class="fa fa-coffee"></i>
    </span>
    <span title="站点阅读时长">4:22</span>
</div>
  <div class="powered-by">由 <a href="https://hexo.io/" class="theme-link" rel="noopener" target="_blank">Hexo</a> & <a href="https://muse.theme-next.org/" class="theme-link" rel="noopener" target="_blank">NexT.Muse</a> 强力驱动
  </div>

        
<div class="busuanzi-count">
  <script async src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
    <span class="post-meta-item" id="busuanzi_container_site_uv" style="display: none;">
      <span class="post-meta-item-icon">
        <i class="fa fa-user"></i>
      </span>
      <span class="site-uv" title="总访客量">
        <span id="busuanzi_value_site_uv"></span>
      </span>
    </span>
    <span class="post-meta-divider">|</span>
    <span class="post-meta-item" id="busuanzi_container_site_pv" style="display: none;">
      <span class="post-meta-item-icon">
        <i class="fa fa-eye"></i>
      </span>
      <span class="site-pv" title="总访问量">
        <span id="busuanzi_value_site_pv"></span>
      </span>
    </span>
</div>








      </div>
    </footer>
  </div>

  
  <script size="300" alpha="0.6" zIndex="-1" src="/lib/canvas-ribbon/canvas-ribbon.js"></script>
  <script src="/lib/anime.min.js"></script>
  <script src="/lib/velocity/velocity.min.js"></script>
  <script src="/lib/velocity/velocity.ui.min.js"></script>

<script src="/js/utils.js"></script>

<script src="/js/motion.js"></script>


<script src="/js/schemes/muse.js"></script>


<script src="/js/next-boot.js"></script>




  















  

  
      

<script>
  if (typeof MathJax === 'undefined') {
    window.MathJax = {
      loader: {
        source: {
          '[tex]/amsCd': '[tex]/amscd',
          '[tex]/AMScd': '[tex]/amscd'
        }
      },
      tex: {
        inlineMath: {'[+]': [['$', '$']]},
        tags: 'ams'
      },
      options: {
        renderActions: {
          findScript: [10, doc => {
            document.querySelectorAll('script[type^="math/tex"]').forEach(node => {
              const display = !!node.type.match(/; *mode=display/);
              const math = new doc.options.MathItem(node.textContent, doc.inputJax[0], display);
              const text = document.createTextNode('');
              node.parentNode.replaceChild(text, node);
              math.start = {node: text, delim: '', n: 0};
              math.end = {node: text, delim: '', n: 0};
              doc.math.push(math);
            });
          }, '', false],
          insertedScript: [200, () => {
            document.querySelectorAll('mjx-container').forEach(node => {
              let target = node.parentNode;
              if (target.nodeName.toLowerCase() === 'li') {
                target.parentNode.classList.add('has-jax');
              }
            });
          }, '', false]
        }
      }
    };
    (function () {
      var script = document.createElement('script');
      script.src = '//cdn.jsdelivr.net/npm/mathjax@3/es5/tex-mml-chtml.js';
      script.defer = true;
      document.head.appendChild(script);
    })();
  } else {
    MathJax.startup.document.state(0);
    MathJax.texReset();
    MathJax.typeset();
  }
</script>

    

  

<script src="/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({"pluginRootPath":"live2dw/","pluginJsPath":"lib/","pluginModelPath":"assets/","tagMode":false,"debug":false,"model":{"jsonPath":"/live2dw/assets/shizuku.model.json"},"display":{"position":"left","width":250,"height":500},"mobile":{"show":false},"react":{"opacity":0.9},"log":false});</script></body>
</html>

<script type="text/javascript" src="/js/src/love.js"></script>
